PM-18 Privacy Program Plan

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Privacy	Organization	None

Related controls: PM-8, PM-9, PM-19

Control statement

• a. Develop and disseminate an organization-wide privacy program plan that provides an overview of the agency’s privacy program, and:
  • 1. Includes a description of the structure of the privacy program and the resources dedicated to the privacy program;
  • 2. Provides an overview of the requirements for the privacy program and a description of the privacy program management controls and common controls in place or planned for meeting those requirements;
  • 3. Includes the role of the senior agency official for privacy and the identification and assignment of roles of other privacy officials and staff and their responsibilities;
  • 4. Describes management commitment, compliance, and the strategic goals and objectives of the privacy program;
  • 5. Reflects coordination among organizational entities responsible for the different aspects of privacy; and
  • 6. Is approved by a senior official with responsibility and accountability for the privacy risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation; and
• b. Update the plan [Assignment: organization-defined frequency] and to address changes in federal privacy laws and policy and organizational changes and problems identified during plan implementation or privacy control assessments.

NIST discussion

A privacy program plan is a formal document that provides an overview of an organization’s privacy program, including a description of the structure of the privacy program, the resources dedicated to the privacy program, the role of the senior agency official for privacy and other privacy officials and staff, the strategic goals and objectives of the privacy program, and the program management controls and common controls in place or planned for meeting applicable privacy requirements and managing privacy risks. Privacy program plans can be represented in single documents or compilations of documents.

The senior agency official for privacy is responsible for designating which privacy controls the organization will treat as program management, common, system-specific, and hybrid controls. Privacy program plans provide sufficient information about the privacy program management and common controls (including the specification of parameters and assignment and selection operations explicitly or by reference) to enable control implementations that are unambiguously compliant with the intent of the plans and a determination of the risk incurred if the plans are implemented as intended.

Program management controls are generally implemented at the organization level and are essential for managing the organization’s privacy program. Program management controls are distinct from common, system-specific, and hybrid controls because program management controls are independent of any particular information system. Together, the privacy plans for individual systems and the organization-wide privacy program plan provide complete coverage for the privacy controls employed within the organization.

Common controls are documented in an appendix to the organization’s privacy program plan unless the controls are included in a separate privacy plan for a system. The organization-wide privacy program plan indicates which separate privacy plans contain descriptions of privacy controls.

Assessment objectives (SP 800-53A)

Objectives and methods for PM-18

Determine if:

• PM-18a.
  • PM-18a.[01] an organization-wide privacy program plan that provides an overview of the agency’s privacy program is developed;
  • PM-18a.01
    • PM-18a.01[01] the privacy program plan includes a description of the structure of the privacy program;
    • PM-18a.01[02] the privacy program plan includes a description of the resources dedicated to the privacy program;
  • PM-18a.02
    • PM-18a.02[01] the privacy program plan provides an overview of the requirements for the privacy program;
    • PM-18a.02[02] the privacy program plan provides a description of the privacy program management controls in place or planned for meeting the requirements of the privacy program;
    • PM-18a.02[03] the privacy program plan provides a description of common controls in place or planned for meeting the requirements of the privacy program;
  • PM-18a.03
    • PM-18a.03[01] the privacy program plan includes the role of the senior agency official for privacy;
    • PM-18a.03[02] the privacy program plan includes the identification and assignment of the roles of other privacy officials and staff and their responsibilities;
  • PM-18a.04
    • PM-18a.04[01] the privacy program plan describes management commitment;
    • PM-18a.04[02] the privacy program plan describes compliance;
    • PM-18a.04[03] the privacy program plan describes the strategic goals and objectives of the privacy program;
  • PM-18a.05 the privacy program plan reflects coordination among organizational entities responsible for the different aspects of privacy;
  • PM-18a.06 the privacy program plan is approved by a senior official with responsibility and accountability for the privacy risk being incurred by organizational operations (including, mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation;
  • PM-18a.[02] the privacy program plan is disseminated;
• PM-18b.
  • PM-18b.[01] the privacy program plan is updated [Assignment: organization-defined frequency];
  • PM-18b.[02] the privacy program plan is updated to address changes in federal privacy laws and policies;
  • PM-18b.[03] the privacy program plan is updated to address organizational changes;
  • PM-18b.[04] the privacy program plan is updated to address problems identified during plan implementation or privacy control assessments.

Examine: Privacy program plan; procedures addressing program plan development and implementation; procedures addressing program plan reviews, updates, and approvals; procedures addressing coordination of the program plan with relevant entities; records of program plan reviews, updates, and approvals; other relevant documents or records.

Interview: Organizational personnel with privacy program planning and plan implementation responsibilities; organizational personnel with privacy responsibilities.

Policy statement

• The Senior privacy official shall develop and disseminate an organization-wide privacy program plan that gives an overview of the privacy program. (PM-18a)
• The plan shall describe the structure of the privacy program and the resources dedicated to it. (PM-18a.1)
• The plan shall give an overview of the requirements for the privacy program, and describe the privacy program management controls and common controls in place or planned to meet them. (PM-18a.2)
• The plan shall include the role of the Senior privacy official, and identify the roles and responsibilities of other privacy officials and staff. (PM-18a.3)
• The plan shall describe management commitment, compliance, and the strategic goals and objectives of the privacy program. (PM-18a.4)
• The plan shall reflect coordination among the organizational entities responsible for the different aspects of privacy. (PM-18a.5)
• The Senior leader, as the senior official accountable for the privacy risk the organization incurs, shall approve the plan. (PM-18a.6)
• The Senior privacy official shall update the plan Fill in: the frequency of updates to the privacy program plan Typical: annually, and to address changes in privacy law and policy, organizational changes, and problems found during plan implementation or privacy control assessments. (PM-18b)

Federal systems

OMB Circular A-130, Appendix II, requires each agency to develop, maintain and update an organization-wide privacy program plan.

• The plan shall address the changes in federal privacy laws and policy that apply to the agency. (PM-18b)

From the Program Management Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

PM-18 asks for an organization-wide privacy program plan, developed and shared with the people who need it (a). It describes the program’s structure and resources, its requirements and the controls that meet them, and its roles. It also covers management commitment, compliance, goals, and coordination among the offices that handle privacy. A senior official accountable for privacy risk approves it, and you update it at a set frequency and after changes or problems (b). PM-18 is in the SP 800-53B Privacy baseline.

NIST’s PM-18 discussion says the plan may be one document or a compilation of documents. The senior agency official for privacy designates which privacy controls are program management, common, system-specific or hybrid. The plan describes the program management and common controls, including their parameters, in enough detail for a compliant implementation and a judgment of the risk. Common controls go in an appendix unless a separate system privacy plan holds them, and the plan says which plans do.

The plan is the privacy counterpart of the Information Security Program Plan (PM-1). The PM-18 clause allows two chapters of one program document, if each chapter meets its own control. Systems inherit the centrally managed privacy controls from it (PL-9).

Common implementations. The Program Management policy has the senior privacy official develop and update the plan and the senior leader approve it. The kit has no separate privacy program plan template. The Information Security Program Plan has the matching structure, and its sections map to PM-18:

PM-18 element	Section to write
Structure and resources (a.1)	Roles and responsibilities; management commitment and resources (sections 3 and 4)
Requirements, program management and common controls (a.2)	Program requirements; program management and common controls (sections 2 and 7), using the privacy controls
Role of the senior privacy official and other privacy staff (a.3)	Roles and responsibilities (section 3)
Commitment, compliance, goals and objectives (a.4)	Management commitment; compliance and performance (sections 4 and 6)
Coordination among privacy entities (a.5)	Coordination (section 5)
Approval (a.6)	Approval (section 9)

Section 7 of the Information Security Program Plan already lists PM-18 to PM-27 as privacy program controls, documented in the privacy program plan. Section 8 records where the plan is kept and when it was last approved. Keep the two plans’ roles and common control tables consistent.

Organization-defined parameters. From templates/policy/pm/. Typical value, which your organization may set differently:

Parameter	Typical value
Plan update frequency (b)	Annually, and to address changes in privacy law and policy, organizational changes, and problems found in plan implementation or privacy control assessments

Evidence assessors ask for.

• The approved plan, with the approver, date and version history (a.6)
• The parts that cover each element a.1 to a.5, including the privacy program management and common controls
• A record of how the plan was disseminated (a)
• The record of the last update, and of updates after law, policy or organizational changes or assessment findings (b)

Inheritance. PM-18 is implemented once, for the whole organization, and every system relies on it. NIST’s PM-1 discussion treats program management controls as independent of any system and distinct from common controls. Each system’s privacy plan points to the program plan for the controls it inherits.

Common findings.

• A privacy section inside the security plan that lists no privacy controls (a.2).
• No description of the privacy program’s resources, such as staff and budget (a.1).
• A plan approved by the privacy official alone, not by a senior official accountable for privacy risk (a.6).
• A plan never updated after a reorganization or a new privacy law (b).
• Common privacy controls that systems claim to inherit but the plan does not describe.

Enhancements. PM-18 has no enhancements.

Federal systems (as of October 2026). OMB Circular A-130, Appendix I, section 4.c(2), requires agencies to “develop and maintain a privacy program plan.” The plan describes the program’s structure, resources, SAOP and staff roles, strategic goals and objectives, and its program management and common controls. Section 4.e(1) gives the duty to the Senior Agency Official for Privacy (SAOP), and Appendix II, section 5.a, lists it among the general privacy requirements. OMB’s FY 2026 SAOP FISMA Reporting Metrics (August 2026) ask SAOPs to submit the privacy program plan through CyberScope with the annual report, due October 30, 2026.

Artifacts

• Program Management Decision Worksheet
• Program Management Policy